CVE-2026-111240: vulnerability in Apache TomEE
Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.2%
The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Affected products
Apache Software Foundation · Apache TomEERelated CVEs — Apache TomEE
In the same product, most dangerous first.
CVE-2018-8031—CVE-2018-8031EPSS 2.0%CVE-2026-111264—Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP methodEPSS 0.3%CVE-2026-111263—Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web applicationEPSS 0.2%CVE-2026-111242—Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identityEPSS 0.2%CVE-2026-111250—Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP serverEPSS 0.2%CVE-2026-97880—Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authenticationEPSS 0.2%